Secrets Management & DevSecOps
Handle secrets the way real DevSecOps teams do — Vault policies, Kubernetes Secrets & Sealed Secrets, SOPS/age encryption, KMS envelope encryption, rotation, and secret-scanning — with browser-graded drills (reusing the HCL & YAML parsers) plus focused flashcard decks.
Flashcard decks
6 decks · 97 cards · in study order1Secrets Management FundamentalsWhat a secret is, why they never belong in code or git, the threat model (secret sprawl, blast radius), and the core principles: least privilege, short-lived over long-lived, rotation, and dynamic secrets. The mental model behind every tool.182HashiCorp Vault EssentialsThe dominant secrets platform: seal/unseal, auth methods, secrets engines (KV v2, dynamic database, PKI, transit), HCL policies, leases & TTLs, tokens and AppRole, and dynamic secrets. Pairs with the /secrets Vault-policy HCL drills.183Kubernetes Secrets & Sealed SecretsHow Kubernetes actually handles secrets — the Secret object, why base64 is NOT encryption, etcd encryption at rest, RBAC, and the GitOps-safe options: Bitnami Sealed Secrets, the External Secrets Operator, and the Secrets Store CSI driver. Pairs with the /secrets k8s YAML drills.174SOPS, age & Encryption at RestEncrypting secret files you can safely commit to Git — Mozilla SOPS and age — plus the crypto model underneath: symmetric vs asymmetric, envelope encryption (DEK/KEK), and cloud KMS (AWS/GCP KMS, Azure Key Vault). Pairs with the /secrets SOPS YAML drills.165Secret Scanning & Hygiene (DevSecOps)Keeping secrets out of code and reacting when they slip: gitleaks & trufflehog, pre-commit hooks, .gitignore/.env discipline, purging git history, and the modern keyless pattern — OIDC workload identity so CI/CD needs no long-lived cloud keys at all.166Secrets Tools & Patterns ComparedThe big-picture map: Vault vs cloud secret managers vs Kubernetes-native vs file-encryption — what each is for, static vs dynamic, and how to pick. The synthesis deck that ties the area together.12
Secrets drills
12 drillsCurated resources
verified July 2026Docs-first: the official tool docs and the OWASP cheat sheet are authoritative enough that adding secondary tutorials would only pad. No books or paid courses listed.
Official docs & tools
HashiCorp Vault Documentationfree · official docsCanonical reference for Vault policies, KV v2, dynamic secrets, AppRole, and the transit engine.HashiCorp Vault Tutorialsfree · officialHands-on guided labs covering secrets management, Kubernetes integration, and certification prep.Kubernetes Secretsfree · official docsExplains Secret types and why base64 encoding is not encryption, plus RBAC guidance.Encrypting Confidential Data at Rest (Kubernetes)free · official docsConfigures etcd encryption at rest via EncryptionConfiguration and provider selection with key rotation.Bitnami Sealed Secretsfree · official repoController plus kubeseal to one-way encrypt Secrets safely into Git using asymmetric crypto.External Secrets Operatorfree · official docsKubernetes operator that syncs secrets from external managers (Vault, cloud KMS) into native Secrets.
Encryption & secret scanning
SOPS (Secrets OPerationS)free · official repoCNCF editor for encrypted YAML/JSON/ENV files using KMS, age, or PGP envelope encryption.age file encryptionfree · official repoSimple modern encryption tool with small explicit keys; pairs directly with SOPS as a backend.gitleaksfree · official repoFast scanner detecting hardcoded passwords, API keys, and tokens across git history.TruffleHogfree · official repoFinds and actively verifies 800+ leaked credential types against live APIs to cut false positives.
Guides & best practices
OWASP Secrets Management Cheat Sheetfree · officialVendor-neutral principles for centralization, least privilege, CI/CD, rotation, and leak incident response.GitHub Actions OIDC for keyless cloud authfree · official docsShows id-token: write and IAM trust policies to swap long-lived secrets for short-lived OIDC tokens.